Every post on this site, grouped by subject. If you’re new here, this is the fastest way to work out what this blog is about: pick whichever cluster looks interesting and go from there.

AI, LLMs, and AI slop (culture + security + tooling)

Critiques of LLM-generated code and culture, alongside hands-on evaluations of AI-powered security tooling: what these tools actually find, and the messes they leave behind.

• Design taste in the age of LLMs: visualizing CVE data
• LLMs are destroying art: the art of code, literature, and culture
• wtf is NS_ERROR_INVALID_CONTENT_ENCODING? investigating shared dictionaries and ChatGPT breakage in Firefox
• From gixy-ng to Gixy-Next: rescuing Gixy from AI slop
• Another AI slop story: ChatGPT vs. Human
• AI slop security engineering: Okta’s nextjs-auth0 troubles
• Retrospective: AI-powered security engineers and source code scanners
• Hacking with AI SASTs: An overview of “AI Security Engineers” / “LLM Security Scanners” for Penetration Testers and Security Teams

Nginx, Gixy-Next, ReDoS, and regex security

Research into nginx configuration pitfalls — proxy_pass URL normalization, DNS caching, allow/deny surprises — plus Gixy-Next (the maintained fork of the Gixy configuration scanner) and work on detecting ReDoS-vulnerable regular expressions.

• Gixy-Next: an overview of a Gixy fork with updated, improved, and new checks
• Identifying ReDoS Vulnerabilities in Nginx Configurations Using Gixy-Next
• Can Nginx Configurations Be Vulnerable to ReDoS Expressions?
• A Comparison of Tools to Detect ReDoS-vulnerable Expressions
• Securely Validating Domain Names with Regular Expressions
• proxy_pass: nginx’s Dangerous URL Normalization of Paths
• nginx “allow” and “deny” directives with “return”
• nginx’s proxy_pass DNS caching problem

Web platform, browsers, feeds, and HTTP/TLS debugging

Debugging writeups from the web’s plumbing: HTTP/2 breakage in intercepting proxies, TLS session key extraction, sandboxed iframes, broken feed caching, and making Firefox behave.

• Debugging failures of HTTP/2 in Burp, mitmproxy, and browsers
• Extracting TLS Session Keys in Burp Proxy a la SSLKEYLOGFILE
• One-Way Sandboxed Iframes: Creating a Read-Only Iframe Sandbox That Can’t Read Back
• Feedburner’s Caching Problem
• wtf Google: cacheable rss feeds are dead, and Atom feeds are delayed
• Firefox now automatically trusting the operating system’s root store for TLS certificates - update: it does so only for user-added ones
• Slack login is broken with noscript
• Making Firefox’s right-click not suck with about:config
• Making Firefox’s right-click not suck, even more, with userChrome.css
• Always ‘Copy Clean Link’ when possible on Firefox, with userChrome.css

FreeBSD, Macs, and hardened networking

Running FreeBSD on Apple hardware, locking down the network layer with encrypted DNS and NTP, and assorted macOS and desktop quality-of-life fixes.

• A Full Guide: FreeBSD 13.3 on a MacBook Pro 11.4 (Mid 2015) (A1398)
• Webcam support on a Macbook running FreeBSD using PCI passthrough
• BCM43602: Debugging a Wifi chipset causing a whole-system hang with FreeBSD’s bhyve VM
• Encrypted DNS over TLS on FreeBSD with Unbound, and Blocking Unencrypted DNS Traffic
• An automatic captive-portal resolver and DNS white-lister for DNS over TLS with Unbound
• Encrypted NTP using NTS and chrony on FreeBSD
• Updating FreeBSD’s datetime without DNS
• Magic Switch: share a Magic Keyboard & Trackpad between two Macs (free)
• Mounting and reading an ext4 drive on MacOS
• Swapping/Remapping the silcrow (S) key for a tilde on international Macbooks
• Exclusive i3 keysyms for specific programs. or: Binding Escape on imagemagick’s import
• Cute color progression for my battery status indicator

Fuzzing and vulnerability research (AFL++, harnessing, corpora)

Practical fuzzing engineering with AFL++: harnessing interpreters and libraries, tuning campaigns, and the tricks that make large-scale fuzzing actually work.

• Fuzzing scripting languages’ interpreters’ native functions using AFL++ to find memory corruption and more
• Automatically Generating a Well-Tuned Fuzzing Campaign With AFL++
• Fuzzing with memfd_create(2) and fmemopen(3)
• Fuzzing glibc’s libresolv’s res_init()
• Fuzzing with multiple servers in parallel: AFL++ with Network File Systems
• Attacking a scripting language’s cryptographic functions with Wycheproof

SSH, LDAP, and internal-network offensive engineering

Offensive tooling and techniques for internal networks: SSH-Snake, SSH backdoors and quirks, LDAP monitoring, and post-exploitation adventures in Kubernetes and Vault.

• SSH-Snake: Automatic traversal of networks using SSH private keys
• SSH-Snake Update: Multi-IP Domain Resolution
• Achieving persistence with a hidden SSH backdoor
• SSH Adventures Continued: Invalid CVE-2018-15473 Patches
• Playing with SSH: carriage returns on stderr output
• Bash and SSH fun: SSH is eating my stdin! Or: why does my Bash script not continue after returning from a function?
• More fun with bash: bash, ssh, and ssh-keygen version quirks
• Dumping bash variable values from memory using gdb
• LDAP Watchdog: Real-time LDAP Monitoring for Linux and OpenLDAP
• Tracking a secret LoginTime LDAP attribute with Operational Attributes
• Nagios Plugins: Hacking Monitored Servers with check_by_ssh and Argument Injection: CVE-2023-37154
• Describing All Kubernetes Pods of All Namespaces for Fun and Profit
• Stealing All of Hashicorp Vault’s Secrets Using Login Enumeration

Big writeups: incidents, vulns, audits, and DoS

The long ones: a 55-vulnerability Squid audit, supply-chain backdoors, libwebp fallout, and other incidents, audits, and denial-of-service research.

• 33 Vulnerabilities in cJSON
• 4 jsoup vulnerabilities
• Hacking fun with zip-slips, tar-slips, symlinks, hardlinks, collisions, and more
• 55 Vulnerabilities in Squid Caching Proxy and 35 0days
• CVE-2023-4863: Fallout hits Facebook; probably much much more
• Two infinite loop / DoS vulnerabilities in image-size
• How to DoS MySQL/MariaDB and PostgresSQL Servers With Fewer Than 55kb of Data
• root with a single command: sudo logrotate
• Supply chain attacks and the many (other) different ways I’ve backdoored your dependencies
• NXDOMAIN’d: Catching unregistered domains for fun and profit
• Network Security: Absurdity of Shared NICs with BMCs and Management Networks
• Bypassing Zscaler, Kandji MDM, and Apple Business Manager for Fun and Lulz
• No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability
• A DoS Attack in RuneScape: In 3-Dimensions!
• Proxy Services, Hijacked Companies, and the Rabbit-Hole of Fake Hosting Companies and Big Sky Services
• Attacking a temperamental ten-year-old Jenkins server
• My 2025 Bug Bounty Stories
• Some Thoughts on “Fixing Security Issues”

Auth, accounts, and credential abuse

How authentication breaks in practice: hardware keys and 2FA, session persistence, credential stuffing, and one very broken bank PIN.

• The End of Yubikeys as 2-Factor-Authentication? Google Breaks 2FA with Yubikeys in Favor of Passkeys
• On the Google Account Persistence Exploit
• Credential Stuffing Done Right: Some Tips
• A RuneScape Hacker’s Dream: An Authenticator and PIN Bypass

Programming, tooling, and practical notes

Smaller tools and practical notes: bash oddities, decompiler abuse, crawlers, and development-environment setups that actually work.

• CCBot: Chrome Checker Bot for Chrome Security Releases
• body: A bash script to get the middle of a file, instead of head | tail
• ipgrep: grepping for ip addresses
• Breaking decompilers with single-function, and no-main() C codebases
• Flattening Arrays, Tail Call Recursion, and Stack Overflows in JavaScript
• A small solution to DNS rebinding in Python
• NodeJS, nvm, yarn, and npm on MacOS in 2025
• CodeQL on MacOS
• Comparing different versions of AWK with WebAssembly
• Crawling every Debian .deb package in history from snapshot.debian.org, learning the .deb format, and finding rate-limiting bypasses
• Creating an eBay crawler for fun and profit

Recon and scanning

Making nmap dramatically faster at service scanning, with measurements.

• 5 Tips For Port Service Scanning 16x Faster: Part 1
• Speeding up nmap service scanning 16x
• Improve nmap’s service scanning with this 1 weird trick!

Video game history and culture series

Research into retro video game history around the world: regional markets, promotional bus tours, and cross-cultural essays.

• Video Games Around The World: South Africa
• Video Game History Around The World: An Essay
• Exploring “Bus Tours” of Nintendo and Sega: The Nintendo Challenger, Campus Challenge, and More
• Some Thoughts on Cross-Cultural Video Game and Music

Personal essays, travel, and culture series

Travel, immigration adventures, workplace culture, and the other things that don’t fit anywhere else.

• On self-imposed constraints and shame
• A helicopter story
• POV: You land at Melbourne Airport
• On being an illegal immigrant, hacking an unlimited Schengen visa, and becoming Polish
• On Iranian Censorship, Bypasses, Browser Extensions, and Proxies
• Losing Sight and Vision of Your Mission and Culture
• Losing Sight and Vision of Your Mission and Culture: Part 2
• Losing Sight and Vision of Your Mission and Culture: Part 3
• Losing Sight and Vision of Your Mission and Culture: Part 3.5
• Revisiting My Old Blog
• Revisiting the past: Security recommendations of a 17-year-old Joshua
• My Wroclaw tourism tips and recommendations
• How I got into the security industry
• Hello, Kafka Support Here, How Can I Help You? GitHub Edition
• On using private browsing mode for half a year